Encryption and AutoIt

[JSThePatriot]

AutoIt is a great and wonderful tool. I have been eager to make a contribution no matter how small. I think this may be something worth adding. Please let me know below what you think.

I have always been interested in Computer and Internet Security. This interest has delved over into AutoIt. I wouldnt even begin to try to create my own encryption except when bored. I basically would like to see if there is enough interest in this for me to undertake this project. I would like everyone to let me know some answers to the following.

1. Do you think AutoIt should have native Encryption/Decryption methods?

2. If so which ones? (ex. Blowfish, RSA, MD5, SHA-1, DES, triple- DES, Rijndael(AES), or any other that you can think of)

3. Do you think that you should be allowed to choose which one to use in your needs? (ex. FileEncrypt("filename", [method]) and/or StringEncrypt("string", [method])) I suppose it could just be straight out Encrypt("data", [method]). Everyone let me know how they think it should be.

The reason I am desiring to see the attention this gets is because there has been an aweful lot of UDF's recently devoted to encrypting and decrypting.

I would love to hear everyones input on this. I appreciate everyones time in reading this and leaving me feedback on this project.

JS

Edited June 24, 2005 by JSThePatriot

[jftuga]

I would like to see md5, sha-1, and crc32 hashing functions for files and strings using FileEncrypt() and StringEncrypt(). It would be great if these could make it into the next production release.

-John

Edited June 24, 2005 by jftuga

[MSLx Fanboy]

I would love to see a few hashing functions, especially if they work on binary files too

Also, 3DES and AES would be very nice, I just don't know enough C++ coding to save my life, let alone made a UDF for MD5 alone...

[Ejoc]

Since microsoft included dll's to access built-in encryption methods, alot of the various methods you mention are already aviable, not all the ones you listed. My UDFs could eaisly be modified / the original C could placed into AutoIt natively and allow for different encryption methods.

I'd say make sure you include it with AutoIt since people mostly ignore UDF encryption functions.

[jftuga]

I'd say make sure you include it with AutoIt since people mostly ignore UDF encryption functions.

<{POST_SNAPBACK}>

I agree with this too. Maybe it is just me, but I didn't know about the UDFs until after using AutoIt for awhile.

-John

[JSThePatriot]

Since microsoft included dll's to access built-in encryption methods, alot of the various methods you mention are already aviable, not all the ones you listed.  My UDFs could eaisly be modified / the original C could placed into AutoIt natively and allow for different encryption methods.

I'd say make sure you include it with AutoIt since people mostly ignore UDF encryption functions.

<{POST_SNAPBACK}>

That was my whole intention. I would love to develop this if there is enough want/need for it. I love UDF's but I also love everything that is apart of the native language. My intention is to submit my work to Jon when I complete it so he can add it into the release.

There are alot of C++ packages already put together that are open source that I would be using to base my code off of because I dont want this to be a halfway effort. I want it to be totally secure. No loop holes in my code type of thing.

I appreciate all of the feedback. I think since we have 4 peoples interest I will atleast start on it and update here with my progress.

JS

[MSLx Fanboy]

I went looking at the cryptdll.dll Microsoft has bundled in XP and Server 2003 (maybe 2000 as well)...but no luck getting it to work. I did find a small MD5 digest based off of the RFC...converted to C++ (or wrapped at least).

It requires MS Developer Studio (or so it seems), I couldn't get it compiled and running with Dev-C++, but I'm just a noob, so...

cmd5.zip

[Ejoc]

I went looking at the cryptdll.dll Microsoft has bundled in XP and Server 2003 (maybe 2000 as well)...but no luck getting it to work.  I did find a small MD5 digest based off of the RFC...converted to C++ (or wrapped at least).

It requires MS Developer Studio (or so it seems), I couldn't get it compiled and running with Dev-C++, but I'm just a noob, so...

<{POST_SNAPBACK}>

I got crypt32.dll working:

My RSA UDF

[MSLx Fanboy]

Only problem being I don't fully understand DLLs, so understanding how your coding works to just deprive the MD5 hash of the "password" is difficult.

I've tried including your code and trying the following

#include<Crypto.au3>
$Context = _CryptAcquireContext()
$hash = _CryptCreateHash($Context)
$test = _CryptHashData($hash, "password")
$test2 = _CryptDeriveKey($Context, $hash)

MsgBox(0, "test", $test)

But does not provide an MD5 Hash (atleast the hex that I'm used to)...

[layer]

I've never really looked into big encryption things... Maybe a glimpse, but I know what encrypting is So I'll support you because this sounds pretty interesting...

[therks]

Native/built-in MD5 hashing would be very nice. I use the MD5 function a lot in PHP and to have something in AutoIt that would yield the same results after the function would be great. So far I have just used the md5.dll that I got off the forum. But I prefer not to have to package extra files with my scripts.

[erifash]

I think these files could be of some help because I would really like to see blowfish implemented into AutoIt. I got these a long time ago and totally forgot about them until now. I also forgot what they contain so could someone please analyze them? Although the names sound pretty obvious, I am a dll n00b that doesn't have the right tools.

[JSThePatriot]

Excellent. I am actually going to be using (I think) another open source project and just adding the proper things to get it included into AutoIt. It is an encryption library. I am just going to double check the code to be sure that it is encrypting properly and according to standards.

The project is Crypto++, they have alot of the most widely used and even some that I have never heard of in their library. I will be using this in conjunction with AutoIt. I will be first including the most requested which to date is the MD5 Checksum. I would like to make this so that you can use almost any encryption method that you would like like so... FileEncrypt("filename", [method])... or something along those lines as I mentioned in my first post.

I really appreciate the interest everyone has shown and am working hard on getting this put together so we can enjoy some native encryption.

JS

[Valik]

Excellent. I am actually going to be using (I think) another open source project and just adding the proper things to get it included into AutoIt.

This is actually a very quick way to get it NOT included. Most of the code in AutoIt is home-brewed. There are a few major obstacles in using a 3rd party library.

• Does it use STL? AutoIt doesn't. STL, though nice, is big. Even though we've long since blown the original maximum size, we still do try to keep the binary as small as possible.
• Does it use compiler specific features? AutoIt can be compiled with a number of compilers aside from just Visual Studio. Although I don't personally care about this particular aspect, others might as I don't believe everybody is using VC++.
• Is it big? If its big and adds a lot to a compiled EXE, its pretty much a no-go.

Most applications use a DLL for encryption purposes. AutoIt can fully interact with DLL's now, I don't see why its necessary to be built in. Why not find (or write) a DLL and then write AutoIt wrapper functions around it with DllCall. As long as its legal to redistribute the DLL, you can near-seamlessly integrate an awesome encryption package into AutoIt without bloating the size of the EXE.

[jftuga]

This is actually a very quick way to get it NOT included.  Most of the code in AutoIt is home-brewed.  There are a few major obstacles in using a 3rd party library.

Most applications use a DLL for encryption purposes.  AutoIt can fully interact with DLL's now, I don't see why its necessary to be built in.  Why not find (or write) a DLL and then write AutoIt wrapper functions around it with DllCall.  As long as its legal to redistribute the DLL, you can near-seamlessly integrate an awesome encryption package into AutoIt without bloating the size of the EXE.

<{POST_SNAPBACK}>

I think that a minimum set of hashing functions should be built into the language such as md5(). I agree that you may not want an enitre encryption library in, but basic, commonly used algorithms should be included with having to resort to using DLLs.

What do others think?

-John

[MSLx Fanboy]

I believe at minimum MD5, so as to atlest verify that files have not changed, a useful tool in making sure a no tampering with a file has occured.

[JSThePatriot]

This is actually a very quick way to get it NOT included.  Most of the code in AutoIt is home-brewed.  There are a few major obstacles in using a 3rd party library. 

• Does it use STL?  AutoIt doesn't.  STL, though nice, is big.  Even though we've long since blown the original maximum size, we still do try to keep the binary as small as possible.

• Does it use compiler specific features?  AutoIt can be compiled with a number of compilers aside from just Visual Studio.  Although I don't personally care about this particular aspect, others might as I don't believe everybody is using VC++.

• Is it big?  If its big and adds a lot to a compiled EXE, its pretty much a no-go.

Most applications use a DLL for encryption purposes.  AutoIt can fully interact with DLL's now, I don't see why its necessary to be built in.  Why not find (or write) a DLL and then write AutoIt wrapper functions around it with DllCall.  As long as its legal to redistribute the DLL, you can near-seamlessly integrate an awesome encryption package into AutoIt without bloating the size of the EXE.

<{POST_SNAPBACK}>

Ah Valik, You speak, and when you do I listen. This library is broken up. I have been looking at it, and I doubt I am going to use it. It doesnt seem practical as well as from my understanding of C++ it isnt very usable. I have alot of studying to do. I have been studying MD5 all day today. I find this an interesting topic (encryption that is). I agree with everyone that some basic functionality needs to be included. I dont think that all of them should be like I was originally thinking.

This Crypto++ I do believe has a .dll and/or has the ability to make one so all of their libraries could be used.

I do not use VC++ I have recently tried a beta version for it, and really have found it distasteful. I personally believe in supporting Open Source as much as possible, such as I use Dev's C++.

Just for everyones knowledge I am not stopping this project. It will be in the end up to Jon and the 'real' developers like Valik to see whether or not it is included. I currently have alot of studying to do on encryption so I will be posting my status as much as possible.

Thank you Valik for your response and to MSLx Fanboy, and jftuga for supporting this project even under some critisism from a developer.

JS

[JSThePatriot]

Just so everyone knows my progress...

Current Progress...

1. I have found the official MD5 Message-Digest Algorithm, they had an example in C.

2. I am currently converting that to C++.

My next steps are as follows...

1. Figure out exactly how to include it in the AutoIt files that I have.

2. Get AutoIt to compile in Dev's C++

3. Test my work. (Compare it to some other MD5 message-digest programs)

4. Submit my work to Jon for Review. (This step is relative to the previous 3 working)

Thanks to everyone who is keeping track of this for your support.

JS

[jftuga]

Are you planning on StringMD5() or FileMD5() or both?

-John

[JSThePatriot]

Are you planning on StringMD5() or FileMD5() or both?

-John

<{POST_SNAPBACK}>

Both.

The syntax will be:

FileEncrypt("filename", [method])

- Default method will = 0 which will use MD5 Message-Digest Algorithm.

- Binary and Text files will be supported if all goes well.

StringEncrypt("string", [method])

- Default method will = 0 which will use MD5 Message-Digest Algorithm.

The up coming second option will be AES, but I am not even going to work on that till later, but I am making it easy to add in. I will then have a StringDecrypt() and FileDecrypt().

I appreciate your concern,

JS